Telnet & SMTP

Home | NewsGroups | Search | About

microsoft.public.windows.server.security

get this group's latest topics as an RSS feed

add this group's latest topics to your My MSN content

add this group's latest topics to your My Yahoo content

Subject

Author

Date

Telnet & SMTP

Tim

07-23-2006

Roger Abell [MV...

Tim

bagins

karl levinson, ...

Tim

Posted by Tim on July 23, 2006, 8:01 pm

Please log in for more thread options

A recent Nessus scan reported that one of my servers has reported two
security holes:

1. Telnet is running and is vulernable to buffer overflows.

2. Port 80 is open and can be killed by sending a request with an too long
Basic authentication field.

Is the Telnet service required for SMTP to properly function?

Thank you.

Posted by Roger Abell [MVP] on July 23, 2006, 9:19 pm

Please log in for more thread options

There is nothing about Windows that requires telnet, including SMTP.
If your port 80 is serviced by IIS and the machine is up to date on
service pack / security patches then what is reported by Nessus is
not accurate.

>A recent Nessus scan reported that one of my servers has reported two

>security holes:

> 1. Telnet is running and is vulernable to buffer overflows.

> 2. Port 80 is open and can be killed by sending a request with an too long

> Basic authentication field.

> Is the Telnet service required for SMTP to properly function?

> Thank you.

Posted by Tim on July 23, 2006, 11:45 pm

Please log in for more thread options

If I turn off the Telnet service, will that take care of the issue where the
banner discloses the ESMTP version?

> There is nothing about Windows that requires telnet, including SMTP.

> If your port 80 is serviced by IIS and the machine is up to date on

> service pack / security patches then what is reported by Nessus is

> not accurate.

>>A recent Nessus scan reported that one of my servers has reported two

>>security holes:

>> 1. Telnet is running and is vulernable to buffer overflows.

>> 2. Port 80 is open and can be killed by sending a request with an too

>> long Basic authentication field.

>> Is the Telnet service required for SMTP to properly function?

>> Thank you.

Posted by bagins on July 24, 2006, 2:29 am

Please log in for more thread options

<quote>
If I turn off the Telnet service, will that take care of the issue where the
banner discloses the ESMTP version?
</quote>

No.

You should definetly disable telnet service if you don't use it, but
disabling it want deny other people ability to use telnet client to connect
to your SMTP service.
Telnet client enables you to use text based communication with telnet
sevice, but you can use it to talk to other services like smtp, pop3 etc.
Changing the SMTP banner:
http://support.microsoft.com/kb/555080

--

************************
Best regards
Bagins
************************

> If I turn off the Telnet service, will that take care of the issue where

> the banner discloses the ESMTP version?

>> There is nothing about Windows that requires telnet, including SMTP.

>> If your port 80 is serviced by IIS and the machine is up to date on

>> service pack / security patches then what is reported by Nessus is

>> not accurate.

>>>A recent Nessus scan reported that one of my servers has reported two

>>>security holes:

>>>

>>> 1. Telnet is running and is vulernable to buffer overflows.

>>>

>>> 2. Port 80 is open and can be killed by sending a request with an too

>>> long Basic authentication field.

>>>

>>> Is the Telnet service required for SMTP to properly function?

>>>

>>> Thank you.

>>>

Posted by karl levinson, mvp on July 24, 2006, 9:28 am

Please log in for more thread options

You should definitely turn off the Telnet service. You and your
administrators would know if you are using it. It's only used by
administrators for remote system administration, and it does so without any
encryption.

Disabling banners does not really increase your security. Here's why:

http://www.securityadmin.info/faq.asp?banner

You didn't tell us what you're using for SMTP services [what version of
Exchange, Windows, etc]. Here's how to modify the SMTP banner for Exchange
2000 and 2003:

http://support.microsoft.com/kb/281224/
www.msexchange.org/tutorials/change-POP3-IMAP4-SMTP-banner-Exchange-2003.html

By the way, TCP port 80 is used for HTTP / web server services. Is there a
reason why that is enabled? Is it for OWA? If it is, Microsoft recommends
using HTTPS / SSL/TLS to encrypt the traffic over TCP port 443.

It sounds like various insecure things have been enabled on this server that
are contrary to Microsoft recommendations for Windows and Exchange. A
remote scan may not detect everything insecure on this server. I would go
through the hardening and security guides for Windows etc. at
www.microsoft.com/technet/security to make sure your server is really
secure.

--
kind regards,
Karl Levinson, CISSP, CCSA, MCSE [MS MVP]
--------------------------------
Microsoft Security FAQ:
http://securityadmin.info

> If I turn off the Telnet service, will that take care of the issue where

> the banner discloses the ESMTP version?

>> There is nothing about Windows that requires telnet, including SMTP.

>> If your port 80 is serviced by IIS and the machine is up to date on

>> service pack / security patches then what is reported by Nessus is

>> not accurate.

>>>A recent Nessus scan reported that one of my servers has reported two

>>>security holes:

>>>

>>> 1. Telnet is running and is vulernable to buffer overflows.

>>>

>>> 2. Port 80 is open and can be killed by sending a request with an too

>>> long Basic authentication field.

>>>

>>> Is the Telnet service required for SMTP to properly function?

>>>

>>> Thank you.

>>>

Similar Threads	Posted
Antigen for SMTP in Workgroup	July 11, 2006, 4:56 am
Telnet	July 11, 2005, 2:44 pm
telnet using port 443	February 28, 2007, 6:55 pm
telnet to port 443 fails	March 1, 2007, 11:51 am
telnet server auth without password, how ?	September 13, 2005, 4:27 pm
Kerberos V5 Authentication for a Telnet Session	October 27, 2005, 3:21 am
Telnet session "Shell process may not have been launched" (Solution)	June 21, 2005, 2:53 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML Sitemap

XML Sitemap